CVE-2010-4879

dompdf 0.6.0 beta1 - Remote Code Execution via input_file Parameter

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-4879. PoCs published by Andre_Corleone.

AI-analyzed exploit summary This is a writeup describing a Remote File Inclusion (RFI) vulnerability in dompdf. The vulnerability arises from improper handling of the `input_file` GET parameter, which is passed directly to `rawurldecode()` without validation.

Description

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.

Exploits (1)

exploitdb WRITEUP
by Andre_Corleone · textwebappsphp
https://www.exploit-db.com/exploits/14851

This is a writeup describing a Remote File Inclusion (RFI) vulnerability in dompdf. The vulnerability arises from improper handling of the `input_file` GET parameter, which is passed directly to `rawurldecode()` without validation.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: dompdf (version not specified)
No auth needed
Prerequisites: A vulnerable version of dompdf · Ability to craft a malicious URL with an RFI payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14851

Scores

EPSS 0.0111
EPSS Percentile 78.7%

Details

CWE
CWE-94
Status published
Products (2)
digitaljunkies/dompdf 0.6.0 beta1
dompdf/dompdf 0.6 - 0.6.1Packagist
Published Oct 07, 2011
Tracked Since Feb 18, 2026